Privacy Policy
Last updated: May 11, 2026
HexaRelay SAS is committed to protecting your personal data in accordance with GDPR (EU 2016/679) and China's Personal Information Protection Law (PIPL).
1. Data Controller
HexaRelay SAS — Les Pennes Mirabeau, France
DPO : [email protected]
2. Data Collected
✉️ Account — Email, password (hashed), display name, preferred language.
🔤 Translations — Transmitted to API, NOT stored. Only the daily counter is retained.
🎙️ Voice audio — Sent to OpenAI Whisper in real time, converted to text, immediately deleted. No audio file stored.
💬 Chat messages — Stored encrypted (AES-256) on OVH/INNOVAPERF servers in France.
💳 Payment — Handled by Stripe (PCI-DSS). No card numbers stored.
3. Legal Bases
| Processing | Legal basis | Purpose |
|---|---|---|
| User account | Contract (art. 6.1.b) | Service delivery |
| Translations & transcriptions | Contract (art. 6.1.b) | Service operation |
| Chat messages | Contract (art. 6.1.b) | User communication |
| Analytics cookies | Consent (art. 6.1.a) | Service improvement |
| Login logs | Legitimate interest (art. 6.1.f) | Security, fraud detection |
4. Retention Periods
| Data | Period |
|---|---|
| Account data | Active period + 3 years |
| Chat messages | Account lifetime |
| Translation content | Not stored — real-time only |
| Voice audio | Not stored — deleted immediately |
| Request counters | 90 rolling days |
| Payment data (Stripe) | 10 years (legal obligation) |
| Login logs | 12 months |
| Encrypted backups | 7 days (rotation) |
5. International Transfers
| Provider | Country | Data transferred | Safeguard |
|---|---|---|---|
| OVHcloud / INNOVAPERF | France (EU) | All stored data | EU hosting, native GDPR |
| OpenAI | USA | Text & audio (anonymised) | DPA + CCT / SCCs |
| DeepSeek | China | Translation text (CN users, anonymised) | PIPL art. 39 consent |
| Stripe | EU / USA | Payment data only | PCI-DSS + CCT |
| Agora | US / Singapore | Real-time video (not stored) | CCT |
6. PIPL Compliance (China)
- Explicit consent at registration (PIPL art. 39): transfer to EU explicitly consented.
- Data minimisation: no identity data transmitted during translations.
- Real-time processing only: voice and text contents are not retained.
- DeepSeek option (China): translations may use DeepSeek to limit cross-border transfers.
- DPIA/PIPIA assessment completed for cross-border transfers.
7. Security
- TLS 1.3 for all network exchanges
- AES-256 for chat messages at rest
- Bcrypt for passwords
- 2FA (TOTP) for admins
- WAF via Cloudflare
- Daily encrypted backups (7-day rotation)
8. Your Rights
Access
Obtain a copy of your data.
Rectification
Correct inaccurate data.
Erasure
Delete your account and all your data.
Portability
Export your data in JSON.
Objection
Object to processing.
Restriction
Restrict processing.
Exercise your rights via Settings → Privacy or by email: [email protected]
9. Cookies
11. Contact
DPO : [email protected]
[email protected]
HexaRelay SAS, Les Pennes Mirabeau, France